I don't know if it can help you, but on the client side, there is a variable "M" which contain the sesskey -> M.cfg.sesskey
(By the way, I actually don't know when/where/why it's created..)
General developer forum
Plugin : Ajax call without token
Hierdie bespreking is gesluit, dus kan jy nie meer daarop antwoord nie.